Document Verification Service (DVS)Commercial Service: Access Policy

Version 2

  1. Purpose

This Document Verification Service (DVS) Commercial Service Access Policy (‘the Policy’) outlines the criteria that private sector organisations (‘Organisations’) must meet in order to be eligible to access the DVS commercial service.

B.Background

The DVS is a secure online system that enables Organisations to confirm that information presented on identity documents matches that held by the document issuing agency. This can assist Organisations to make identity based decisions by providing greater assurance that the information presented on identity documents is legitimate.

The DVS can also help prevent the use of stolen or fraudulent identity documents, which in turn helps to prevent identity crime, protect privacy and promote greater confidence in the identities that Australians use to access a wide range of government and other commercial services.

As a key element of the National Identity Security Strategy, agreed by the Council of Australian Governments, the DVS is owned and operated by the nine governments of Australia. This responsibility is exercised by all jurisdictions through the National Identity Security Coordination Group and its supporting DVS Advisory Board (also referred to as DVS Agencies). Following the agreement of all Australian governments to provide DVS access to private sector organisations, a DVS Commercial Service commenced operation in early 2014.

Consistent with the objectives of all Australian governments to reduce regulatory impacts on industry, DVS Agencies will draw on existing regulatory and licensing regimes to help determine Organisations’ eligibility for DVS access.

The DVS supports the rights and protections afforded to individuals under the Australian Privacy Principles (APPs) contained in the Privacy Act 1988. Inorder to confirm the accuracy of information presented on documents commonly used as evidence of identity, DVS verifications involve the use of government identifiers. Organisations seeking to use the DVS therefore need to meet the requirements for the use of government identifiers that are outlined in the APPs.

C. Access Criteria

Private sector organisations applying to become DVS Business Users will need to meet the following access criteria.

  1. Subject to the Privacy Act: The Organisation is subject to the Privacy Act 1988(Cth) orthe PrivacyAct 1993 (New Zealand).
  2. Based in Australia or New Zealand: The Organisation has a physical presence in Australia or NewZealand and is subject to local civil and criminal laws.
  3. Permitted to use or disclose Government Related Identifiers: The Organisation can satisfy the requirements of APP 9.2 relating to the use or disclosure of government related identifiers, including one or more of the following:
  1. the use or disclosure of the identifier is required or authorised by or under an Australian law or a court/tribunal order; or
  2. the use or disclosure of the identifier is reasonably necessary for the Organisation to fulfil its obligations to an agency or a State or Territory authority
  3. the use or disclosure of the identifier is reasonably necessary for the Organisation to verify the identity of the individual for the purposes of the Organisation's functions or activities; or

Or if the Organisation is based in New Zealand, it can satisfy an equivalent requirement.

  1. Regulated Entities: The Organisation is registered or licensed or operates under a regulatory regime operated by the Commonwealth, State and Territory or New Zealand Governments. This includes, but is not limited to:
  1. Commonwealth licencing schemes under the Corporations Act 2001, the Banking Act 1959 and the Telecommunications Act 1996;
  2. State and Territory legislation relating to electronic conveyancing or electricity distribution or other legislation; or
  3. any equivalent New Zealand legislation.
  1. Use of Gateway Service Provider: The Organisation accesses the DVS through an approved Gateway Service Provider (GSP) or successfully applies to become a GSP in its own right.
  2. Requirements for DVS Use: The Organisation has the capacity and agrees to comply with all requirements for use of the DVS commercial service, including but not limited to:
  1. obtaining the informed consent of its clients for DVS matching
  2. only using the DVS for the purpose(s) for which access has been granted
  3. information security and access controls, including logging and monitoring use of the system
  4. compliance reporting, and
  5. being reasonably subject to independent audits of its use of the DVS.

D.Using or disclosing Government related identifiers

In accordance with the Privacy Act 1988, the primary responsibility for assessing and demonstrating that an Organisation may use or disclose government related identifiers (i.e. to use the DVS) rests with the Organisation itself.

Prospective DVS Business Users may wish to refer to the supporting guidelines to this policy for further information on assessing reasonable necessity.

E.Consideration of applications

Applications for access to the DVS Commercial Service will be considered by DVS Agencies, which are not under any obligation to provide an individual Organisation with access to the DVS.

However, in most cases DVS Agencies will approve applications from prospective DVS Business Users where:

  1. the Organisation meets the criteria outlined in this policy;
  2. the Organisation pays the applicable fees at the time of application; and
  3. DVS Agencies do not have a specific and material objection to the Organisation being provided with access to the DVS.

1

Commercial Service: Access Policy

Version 2

Document Verification Service (DVS)

Commercial Service:

Access Guidelines

Version 1

Table of Contents

Table of Contents

A.Purpose

B.DVS Access Policy Criteria

C.Access Criterion 1: Subject to the Privacy Act

D.Access Criterion 2: Based in Australia or New Zealand

E.Access Criterion 3: Reasonable Necessity to Use Government Related Identifiers

F.Access Criterion 4: Regulated Entities

G.Access Criterion 5: Use of Gateway Service Provider

H.Access Criterion 6: Requirements for Use of the DVS

I.Application Process

J.Further information

Attachment A – Reasonable necessity and the DVS: Illustrative Examples

1

Commercial Service: Access Guidelines

Version 1

F.Purpose

These Document Verification Service (DVS) Commercial Service Access Guidelines (‘the Guidelines’) are designed to provide further information on the criteria that private sector organisations (‘Organisations’) must meet in order to be eligible to access the DVS commercial service, as outlined in the DVS Commercial Service Access Policy (‘the DVS Access Policy’).

The Guidelines are intended to assist:

  • Organisations in completing applications for DVS Business User access;
  • DVS Agencies in assessing applications for DVS Business User access; and
  • Both DVS Business Users and DVS Agencies in ensuring that terms and conditions of DVS access continue to be met while an Organisation uses the system.

These Guidelines draw upon the Australian Privacy Principles Guidelines (the APP Guidelines) produced by the Office of the Australian Information Commissioner. They should be read in conjunction with the APP Guidelines, the DVS Access Policy, and the terms and conditions applicable to DVS Business Users.

These Guidelines do not represent a legal opinion on the requirements of the Privacy Act 1988. Organisations that are concerned about their privacy obligations should seek independent legal advice.

G. DVS Access Policy Criteria

The DVS Access Policy outlines a number of criteria and Organisations must satisfy all of these criteria in order to be provided with DVS access. These criteria can be summarised as follows:

Access Criterion 1: Subject to the Privacy Act

Access Criterion 2: Based in Australia or New Zealand

Access Criterion 3: Permitted to Use or Disclose Government Related Identifiers

Access Criterion 4: Regulated Entities

Access Criterion 5: Use of Gateway Service Provider

Access Criterion 6: Requirements for Use of the DVS

Further information on these criteria and their application is contained in the following sections of these Guidelines.

H. Access Criterion 1: Subject to the Privacy Act

H.1.Subject to the Privacy Act: The Organisation is subject to the Privacy Act 1988 (Cth) or the Privacy Act 1993 (New Zealand).

H.2.The Privacy Act 1988 (Cth) (the Australian Privacy Act)

The Privacy Act 1988 (Cth) contains the Australian Privacy Principles (APPs), which outline responsibilities for the collection, use, storage and disclosure of personal information. Organisations that are subject to these and other Privacy Act requirements are known as ‘APP entities’. They include Organisations that may not normally be covered by the Act, but which choose to ‘opt-in’ by formally registering with the Privacy Commissioner.

Organisations automatically subject to the Australian Privacy Act

In general terms, an Organisation will be automatically bound by the Australian Privacy Act if it has an annual turnover of more than $3 million in a financial year.

Organisations otherwise subject to the Australian Privacy Act

Businesses with a yearly turnover of $3 million or less may also be subject to the Australian Privacy Act if they:[1]

  • provide a health service and hold health information other than in an employee record, or
  • collect or disclose another person’s personal information as part of their business to provide a benefit, service or advantage (unless they do so with that person’s consent or as authorised by law), or
  • are a contracted service provider with a Commonwealth contract, or
  • are a reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006.

Opting-in to the Australian Privacy Act

Other businesses with a yearly turnover of $3 million or less may formally register with the Privacy Commissioner to ‘opt in’ to be subject to the Australian Privacy Act.

A business can opt-in by filling in the designated application form and being placed on the public Opt-in Register by the Privacy Commissioner. More information on opting-in can be found on the website of the Office of the Australian Information Commissioner.

H.3.The Privacy Act 1993 (New Zealand) (the New Zealand Privacy Act)

DVS access may also be provided to businesses in New Zealand, as all these organisations are subject to the New Zealand Privacy Act.

This Act binds any ‘agency’, which is defined broadly to mean ‘any person or body of persons, whether corporate or unincorporate, and whether in the public sector or the private sector’.[2]

The New Zealand Privacy Act contains a range of protections over the use of personal information.

I.Access Criterion 2: Based in Australia or New Zealand

Based in Australia or New Zealand: The Organisation has a physical presence in Australia or NewZealand and is subject to local civil and criminal laws

DVS access may only be provided to Organisations that are either based in Australian or New Zealand. Thisincludes Organisations that have a physical presence in either country, even though the parent company may be based overseas.

This requirement helps to ensure that, in the event that an Organisation misuses the result of a DVS check, the Organisation may be subject to civil or criminal proceedings under Australian or NewZealand law, as appropriate. This includes the ability for the affected individual(s) to seek redress from the Organisation under civil law.

For the purposes of DVS access, an Organisation is considered to be based in Australia or NewZealand where it is:[3]

  • an Australian or New Zealand citizen or permanent resident, or
  • a person whose continued presence in Australia is not subject to a limitation as to time imposed by law, or
  • a partnership formed, or a trust created, in Australia, an external Australian Territory, or New Zealand, or
  • a body corporate incorporated in Australia or New Zealand, or
  • an unincorporated association that has its central management and control in Australia, an external Australian Territory or New Zealand.

This is an additional requirement to that in Criterion 1, as an Organisation may be subject to Australian privacy law (i.e. have an ‘Australian Link’_) without necessarily being based in Australia.

J. Access Criterion 3: Permitted to use or disclose Government Related Identifiers

Permitted to Use or Disclose Government Related Identifiers:The Organisationcan satisfy the requirements of Australian Privacy Principle 9.2 relating to the use or disclosure of government related identifiers, by one or more of the following:

  1. the use or disclosure of the identifier is required or authorised by or under an Australian law or a court/tribunal order; or
  2. the use or disclosure of the identifier is reasonably necessary for the Organisation to fulfil its obligations to an agency or a State or Territory authority; or
  3. the use or disclosure of the identifier is reasonably necessary for the Organisation to verify the identity of the individual for the purposes of the Organisation's functions or activities.

Or if the Organisation is based in New Zealand, it can satisfy an equivalent requirement.

J.1.Australian Organisations

DVS verifications involve the handling of government related identifiers, such as document numbers on passports, driver licences, and Medicare cards.

The Australian Privacy Act restricts the adoption, use and disclosure of government related identifiers by private sector organisations, unless the organisation can meet one of the specified exceptions. These exceptions to the use and disclosure of government related identifiers are outlined in Australian Privacy Principle 9.2 and include that the use or disclosure of the identifier is:[4]

  • required or authorised by or under an Australian law or a court/tribunal order.[5]
  • This exception relates to both Commonwealth and State and territory legislation.
  • reasonably necessary for the Organisation to fulfil its obligations to an agency or a State or Territory authority.[6]
  • This exception, which includes non-legislative obligations, is most likely to be relevant to a contracted service provider, and will allow them to use or disclose a government related identifier if this is reasonably necessary to perform a Commonwealth or State or Territory contract.
  • reasonably necessary for the Organisation to verify the identity of the individual for the purposes of the Organisation’s functions or activities.[7]
  • This exception allows an Organisation to use a government related identifier both to establish the identity of an individual and to verify that an individual is who or what they claim to be, for example, to verify their name or age.

J.2.New Zealand Organisations

For the purpose of DVS access, corresponding access criteria have also been developed for NewZealand Organisations that are subject to the New Zealand Privacy Act. These allow DVS access to be granted to Organisations, where the use or disclosure of an Australian government related identifier is:

  • required or authorised by or under a New Zealand law or a court/tribunal order; or
  • reasonably necessary for the Organisation to fulfil its obligations to New Zealand Government authority; or
  • reasonably necessary for the Organisation to verify the identity of the individual for the purposes of the Organisation's functions or activities; and
  • consistent with any relevant Australian law or regulations.

J.3.Identifying the functions and activities of an Organisation

In the context of the Australian Privacy Act, an Organisation’s functions and activities include:[8]

  • the current functions or activities of the Organisation,
  • proposed functions or activities that the Organisation has decided to carry out and for which it has established plans; and
  • activities that the Organisation carries out in support of its other functions and activities, such as human resources, corporate administration, property management and public relations activities.

The functions and activities of an Organisation will commonly be described (though not necessarily exhaustively) on a website, in an annual report, and in corporate brochures, advertising, product disclosure statements and in client and customer letters and emails.[9]

The functions and activities of an Organisation (for which it may collect and use personal information under the Privacy Act) are limited to those in which it may lawfully engage.[10]

J.4.Determining Reasonable Necessity

It is the responsibility of a prospective DVS Business User, as an APP entity, to be able to justify that the use and any disclosure of a government related identifier (i.e. as the result of using the DVS) is in accordance with the exceptions provided in Australian Privacy Principle 9.2.[11]

The exception in APP 9.2(a) allows an Organisation to use or disclose a government related identifier where it is reasonably necessary for the Organisation to verify the identity of the individual for the purposes of the Organisation’s functions and activities. The exception in APP 9.2(b) allows an Organisation to use or disclose a government related identifier where it is reasonably necessary to fulfil its obligations to an agency or a State or Territory authority.

The ‘reasonably necessary’ test is an objective test: it is a question of whether a reasonable person who is properly informed would agree that theuse or disclosure is necessary (not merely from the perspective of the Organisation proposing to undertake the activity). The test must be applied in a practical sense.[12]

In general terms, if an Organisation cannot, in practice, effectively pursue a lawful function or activity without using or disclosing a government related identifier in order to verify a person’s identity, the use of the identifier would usually be considered reasonably necessary for that function or activity.

Where an Organisation is seeking to determine whether it has a reasonable necessity to use and disclose a government related identifier to verify a person’s identity for the purpose of the Organisation’s functions or activities, such as by using the DVS, it may be relevant to consider whether the use or disclosure of the government related identifier:

  • ensures the Organisation is not unreasonably exposed to risks resulting from identity crime or other serious crime, having regard to the entity’s functions or activities
  • provides a more privacy-enhancing means of identity verification than alternative methods.

These examples are provided for illustrative purposes only to assist Organisations in interpreting the requirements of APP 9.2(a).

It may not be reasonably necessary to use or disclose a government related identifier to verify the identity of an individual or fulfil its obligations to an agency or State or Territory authority wherethere are reasonable alternatives available. This includes situations where:[13]

  • the Organisation can carry out the function or activity, or fulfil its obligations to an agency or State or Territory authority, without verifying the individual’s identity, for example:
  • where de-identified information would be sufficient for the function or activity; or
  • where a deposit or other financial guarantee would be sufficient for the function or activity
  • there are other practicable means of verifying the individual’s identity available to the Organisation, for example:
  • by using or disclosing other types of personal information, rather than the government related identifier; or
  • the Organisation has an established history of transacting with the individual.

In this context, Organisations should note their obligation to provide individuals with an option to transact on the basis of pseudonymity or anonymity, where this is not impracticable for the Organisation to do so.[14]